[Sip-security] Re: [Sipping] Re: SIP authentication problem when using RES in Digest-AKA

Hi,

On 03/15/2002 11:41 AM, ext Jari Arkko wrote:

[snip]

> Let's study this by considering two cases:
> 
> (a) AKA is run at the beginning and if any further
>     communications with the home network take place,
>     the RES is cached and used as a password. This
>     allows the attack described by Greg. But as
>     Aki explained, it seems that we have forbidden
>     this in Draft-niemi.

I would further divide this into two subcases:

(a1)
The actual Digest credentials are cached, and the UA attempts to use 
them in further communications with the same server. If the server is 
not happy with then, it can rechallenge.

(a2)
The RES is cached, and used again as part of the stale nonce scheme when 
calculating Digest credentials.

 From these two, I'd say only the second case seems to be forbidden in 
draft-niemi.

Regards,
Aki

> (b) AKA has to be run every time, and a RES can't be
>     reused. Is there a problem left then?
> 
> Jari
> 
> 
> _______________________________________________
> Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
> This list is for NEW development of the application of SIP
> Use sip-implementors@cs.columbia.edu for questions on current sip
> Use sip@ietf.org for new developments of core SIP
> 

_______________________________________________
Sip-security mailing list
Sip-security@ietf.org
https://www1.ietf.org/mailman/listinfo/sip-security